I use an antimalware program- the scan finds a PUP (Potentially Unwanted Program), which is quarantined and removed. It comes back! I am guessing it is stored somehow to resurface after normal shut down and reboot. Where can this be hiding out? Someone suggested Google Drive? PUP's location in file says C User (my Wife) App Data Local Google Chrome User Data Default Extension then a string of random letters. It found this same instance 40 times of the same PUP on recent scan, but I thought this was taken care of when I first found this along time ago. I can find the same string of letters if I search verbatim in Google search. Google Forum said: I'd recommend running a scan on your computer with a trusted anti-virus software. If the scan detects any suspicious programs or applications, remove them immediately. Which is what I have done over and over..

3 Answers 3


Related question: Can Chrome sync be infected?

It sounds like the user is signed in to Chrome sync, which by default syncs extensions. Having an unwanted extension keep installing itself via the browser's Sync feature has happened to me and my users several times.

When your antivirus program removes the extension, Chrome Sync only sees that the extension isn't installed on that device, but it's still in your list of extensions in the cloud, so Sync re-installs the extension.

This might be difficult to fix, depending on the number of machines where the user has signed in to Chrome sync.

The fix:

  1. On every machine where the user has Chrome Sync turned on, go to chrome://settings/syncSetup and click "Turn off".
    • This is the hardest step. If you miss a machine, the next time that machine is turned on, Chrome Sync will sync that machine's extensions list to the cloud, and install all of them on your other synced machines.
      Turn Off button for Chrome sync
  2. On every machine where the user had Chrome Sync turned on, go to chrome://extensions/ and remove the extension.
    • If you're not sure which one it is, I recommend removing all the extensions, just to be safe.
    • If you really don't want to remove all of them, enter chrome://extensions/?id=EXTENSIONID in the address bar, where EXTENSIONID is the ID from the %localappdata%\Google\Chrome\User Data\Default\Extensions folder you mentioned. That will bring up the specific extension, if it's still installed.
      screenshot of ID in extension's address bar matching ID in AppData folder
  3. Go to https://chrome.google.com/sync, scroll to the bottom, and click "Clear data."
    • This will only delete the copy of the synced data stored in the cloud, not the copy stored on your machines, so you don't have to worry about losing saved passwords or bookmarks. This is also why it is so important to remove the extension from every machine with sync turned on.screenshot of location of Clear Data button in Google account sync settings
  4. If desired, sign back in to Chrome sync.

If the program is in Google Chrome's User App Data folder, it is probably being downloaded as a temporary internet file. Every Time a user browses a website, the page is downloaded to that folder. So either your wife has downloaded multiple versions of a malicious file, or she keeps going to the same page to download the PUP. To eliminate the possibility there are just a lot of instances of the file, try deleting Google's entire folder in App Data and restarting the browser.

Other more advanced techniques could include a root kit, or a malicious version of chrome, but these are less likely.

  • The PUP being detected is a Chrome extension. It's not a temporary file.
    – user82155
    Commented Mar 27, 2017 at 21:04
  • In that case having your antimalware software will only delete the file, chrome will redownload it. Try removing it from settings > extensions.
    – MikeSchem
    Commented Mar 27, 2017 at 21:31
  • So did it work?
    – MikeSchem
    Commented Mar 29, 2017 at 15:22

You need to find the infector file. You might have installed a shady desktop application or a chrome plugin.

  • I don't think that downvotes are warranted, this answer is short enough that yes, it could have been a comment, but at the same time it does give OP an educated guess as to what is most likely to have happened (aka a malicious extension that needs to be removed).
    – xoxel
    Commented Jan 25, 2023 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .